For awhile now a user is having issues with his AD account locking up a few times a day.
I have enabled the audit logs in windows GPO to show login attempts and pushed it out to our 3 domain controllers.
They werent really showing anything (failure wise) so i went to the users workstation and looked at event viewer and its not showing that he failed to login 5 times. this leads me to believe its something more to do with email as his domain account cannot be accessed outside the building, and this problem started when he updated his password 2 weeks ago.
I've been searching for a way to look at exchange 2010s audit logs for failed login attempts but i have not been able to find anything beyond the GPO i have already setup.
Does anyone have any idea on this? The next thing i'm thinking is to change his login usersname and that would make so any email accounts he had setup at home/anywhere wouldnt lock the account anymore.
Any advice would be awesome!